jobtrackingapp/docs/roadmap/todo.md

# TODO

Phase 7 execution started: 2026-10-11, from synchronized `b531998` on `codex/ui-redesign-phase4`. The owner explicitly chose to keep `main` unchanged; production remains NO-GO. Earlier checkpoint records below retain their original scope and qualifications.

## Current repository work

- **P5-15-01R-03 — GO for bounded Analytics authentication return repair:** [record](../redesign/phase-5/p5-15/p5-15-01/analytics-auth-repair/README.md). Original AUTH-01 is RED→GREEN; safe complete pathname/query/hash/context, local retry/history/expiry/logout and native foreign404/tampered-target journeys pass. Fresh backend1,033/frontend490(+18)/browser134(+5cases, formerfailure nowpassing)/diagnostics2; saved-search3, Rules4, P2-D01, revision5 and fidelity16/36+settings8/24 remain green. All57 groups reconcile to56PARTIAL/1DEFERRED. Reproducer and code checkpoints are pushed; final evidence receives its own immediate push. Production NO-GO/main unchanged. Stop before P5-15-02/P5-13/Docker/B07/deployment; human/provider/device, production readiness, existing debt and the CV intermittent observation remain open.

- **P5-15-01R-02 — GO for bounded Rules draft repair:** [record](../redesign/phase-5/p5-15/p5-15-01/rules-draft-repair/README.md). Native RED→GREEN retains5 on tab return/persisted14/zero writes; Save/reload, validation/error/retry, Discard and account isolation pass. Fresh backend1,033/frontend472/browser128pass+1Analytics failure/diagnostics2pass; standard/settings fidelity16/8 and revision5 unchanged. All57 groups reconcile to55PARTIAL/1FAIL/1DEFERRED. Code checkpoints pushed; final evidence follows its immediate commit/push boundary. Analytics remains unrepaired; P5-15-02/P5-13/Docker/B07/production are not started or cleared.

- **P5-15-00 — acceptance planning only:** [final acceptance programme](../redesign/phase-5/p5-15/README.md) reconciles every Phase 5 slice, all 57 original PRES groups and retained routes, incomplete axe/manual/device qualifications, CV/native/revision boundaries and A/B/C/D debt/release gates. No new application/test change or fresh suite result; inherited 1,023 backend / 459 frontend / 117 browser remains. P5-13 deferred, full Phase 5 incomplete and production NO-GO. Push this documentation checkpoint and stop for review; each subsequently completed logical P5-15 checkpoint must be separately committed/pushed. No production `main` push, B07 or automatic 01 execution.

- **P5-14 — scoped responsive CV checkpoint, CONDITIONAL GO:** [implementation/acceptance record](../redesign/phase-5/p5-14/README.md) covers implemented P5-09–12, measured shell clearance, bounded preview chrome/canvas, pane-owned Ctrl+Home/End, nested drag/drop protection, save/conflict recovery and 320–1440px/landscape evidence. Final baseline: **1,023 backend / 459 frontend / 117 actual browser passes**, sidecar 49, real HTTP 2, security/configuration 9/6/1/3; revision 5/5, original fidelity 16/16 with 36 aligned pages and settings exports 8/8 with 24 aligned pages. Production remains NO-GO and no `main` deployment occurred. P5-13 stays deferred/unqualified; incomplete/human/device/zoom/font/production gates remain open. Stop before P5-15/B07; acceptance planning is the next recommendation only.

- **P5-13 — DEFERRED / BLOCKED / NOT QUALIFIED:** [outstanding-work register](../redesign/phase-5/OPEN_BLOCKERS.md#p5-13-deferred-debt-and-return-conditions--2026-10-08) retains 32 frozen cases, 366 required/0 completed model calls, 0 human reviews, unmeasured factuality, unavailable environment/unverified deployed identity and unimplemented AI review UI. Deterministic protections and Production withholding remain; no unrelated Docker recovery retries. The separate [fresh production assessment](../redesign/phase-5/production-release-decision/README.md) identifies automatic deployment from `main` and records **PRODUCTION NO-GO** pending actual ingress/current backup-restore/configuration/rollback evidence. Connor authorizes scoped P5-14 independently of release success; missing AI-review acceptance remains explicit. P5-15 must carry the debt and commit/push every individual change/checkpoint when authorized.

- **P5-11 — live preview presentation complete:** [implementation record](../redesign/phase-5/p5-11/README.md) retains the native renderer, physical geometry, settings/history/source owners and pane modes. Fit/count/return chrome, readable busy/error/retry, semantic canvas/white paper and stable label slots have native keyboard/scroll evidence. Baseline: **941 backend / 434 frontend (+4) / 108 actual browser passes (+2)**, security 9/6/1, configuration 3; revision 5/5, fidelity 16/16 and 36 aligned pages. Forty-four final captures/211 axe scans retain incomplete/manual/sticky-boundary qualifications. The first complete smoke-selector failure and exact-mode regression correction are documented. Stop before P5-12+ or B07; F04, human screen-reader, production font/photo, pointer/reflow and separate debt remain open.

- **P5-10 — CV section editing/source clarity complete:** [implementation record](../redesign/phase-5/p5-10/README.md) retains P5-09's frame and existing canonical/settings/history/rendering owners. Scope-labelled fields, independent reset, editable omitted entries and compact custom-entry actions have native persistence/focus evidence. Baseline: **941 backend / 430 frontend (+4) / 106 actual browser passes (+4)**, security 9/6/1, configuration 3; revision 5/5 and fidelity 16/16, 36 aligned pages. EN/Bokmål, light/dark, desktop/intermediate/320px evidence retained; 205 axe scans report zero violations but retain incomplete findings. Stop before P5-11+ or B07. F04 and human screen-reader/font/photo/pointer qualifications stay open.
- **P5-10-O01 — scoped closure in P5-14:** [ownership/default-drop evidence](../redesign/phase-5/p5-14/README.md#reproduced-failures-and-bounded-corrections) protects entry versus section gestures, cancels unsupported foreign editable drops and retains valid native order/persistence plus named alternatives. Original [observation](../redesign/phase-5/p5-10/README.md#separately-scoped-drag-caveat) remains historical. No cross-section transfer feature or physical-touch/all-browser certification is implied.

- **P5-09 — CV editor frame/navigation complete:** [implementation record](../redesign/phase-5/p5-09/README.md). Content-first studio, compact document identity/scope/actions, ordered section navigation and explicit keyboard preview entry reuse the existing forms/save/history/render owners. Baseline: **941 backend / 426 frontend (+4) / 102 actual browser passes (+4)**, security 9/6/1, configuration 3; revision 5/5 and fidelity 16/16 with 36 aligned pages. EN/Bokmål, light/dark and desktop/intermediate/phone evidence retained; incomplete checks and pointer/reflow qualification are explicit. Stop before P5-10+ and B07. F04, production font/photo and human screen-reader acceptance stay open.

- **CV pagination-fidelity repair complete — GO for P5-09:** [native pagination evidence](../redesign/phase-5/p5-09-pagination-readiness/README.md) resolves all six original failures, **16/16** at unchanged tolerances, 36 preview/native PDF pages. PDF and accepted [revision protection](../redesign/phase-5/p5-09-readiness/README.md) remain unchanged. Baseline: **941 backend / 422 frontend / 98 actual browser passes (+2)**, security 9/6/1, configuration 3. Broader photo/wrapped-line/deployment-font qualification and native print-quality/control debt remain recorded. Stop before P5-09+ or B07; F04 and human screen-reader acceptance stay open. P2-D01 is ordinary passing.

- **P5-08b — Job sections complete:** [section architecture/preservation record](../redesign/phase-5/p5-08b/README.md) owns seven URL-backed sections, Application and Timeline subsections, current versus frozen documents, readable Timeline/Notes/tasks/correspondence/interview presentation and local read-error handling. Existing native packages, legacy/numeric links, query/history, Jobs Back focus and all domain owners remain. Final baseline: **936 backend / 418 frontend (+6) / 93 actual browser passes (+5)**, zero expected failures; security 9/6/1, configuration 3. Eight scoped mounted-page scans have no violations but retain incomplete findings; human screen-reader acceptance is not passed. Stop before P5-09: revision/rendering gates remain; F04 stays open. Historical checkpoint counts below are not current expected failures.

- **P5-08b readiness complete — GO:** [native package/navigation/accessibility record](../redesign/phase-5/p5-08b-readiness/README.md) owns the provider-compatible capture repair, frozen source/file/account-ZIP proof, existing disclosure destinations, retained query/history and scoped ARIA/keyboard fixes. Backend 936 (+2), frontend 412 (+4), browser 88 actual (+4 new and P2-D01 converted to a real pass), zero expected failures; security 9/6/1 and configuration 3. Connor approved preserving follow-up metadata and deferring absent mode-specific UI to the mail phase. No deeper redesign, CV or B07 work. F04 and manual screen-reader acceptance remain open. Older checkpoint counts below are historical.

- **P5-08a — Job header and Overview complete:** shared role/company/status/actions header, recorded date summary, native preparation entries and keyboard-scrollable progress; five section keys/six deeper disclosures and all route/domain owners retained. [Record](../redesign/phase-5/p5-08a/README.md). Baseline: 934 backend, 408 frontend (+5), 83 actual browser passes (+2) plus unchanged P2-D01 expected failure; security 9/6/1, configuration 3. P4-02-D03 closes locally. P5-08b is **NO-GO pending native package proof and its own adapter/draft/AI/deeper-accessibility gates**; no B07 or deeper migration. F04 and manual screen-reader acceptance remain open.

- **P5-07 — existing-report Analytics destination complete:** meaningful authenticated `/analytics`/Insights entry, shared retained Dashboard report owner, current-versus-window definitions, exact values and existing status/company drill-downs. [Record](../redesign/phase-5/p5-07/README.md). Baseline: 934 backend, 403 frontend (+5), 81 actual browser passes (+2) plus unchanged P2-D01 expected failure. Dashboard's five owner-local flags and all original routes remain; no new metrics/backend contracts. P5-08a is recorded separately above; F04, P2-D01, incomplete axe/manual screen-reader, P5-06-O01 and the P5-07-O01 observation remain open.

- **P5-06 — personal Dashboard presentation complete:** existing reports, actions and five owner-local visibility flags retained; precise population/period/sample captions, shared-scale activity and exact keyboard-accessible values, independent error/retry, and native account-switch evidence. [Record](../redesign/phase-5/p5-06/README.md). Baseline: 934 backend, 398 frontend (+8), 79 actual browser passes (+2) plus unchanged P2-D01 expected failure; security 9/6/1, configuration 3. No new metrics/backend contracts or Phase 8 customization. P5-07 is recorded separately above; F04, incomplete axe and manual screen-reader acceptance remain open.
- **P5-06-O01 — native language-preference 500, cause unproven:** the first full browser attempt observed a generic 500 during overlapping Dashboard/setup reads after Browser Back. Visual preparation now requires the native preference save before mounting the next Dashboard; no retry or backend repair. Investigate the unchanged endpoint separately; concurrent language writes during loading remain uncertified. [Evidence](../redesign/phase-5/p5-06/README.md#regression-protection).
- **P5-07-O01 — existing confirmation focus observation:** an inherited light/English desktop attachment test failed Shift+Tab-to-Delete after initial Cancel focus. The unchanged provider refocuses Cancel on transition entry; a transition/focus race is plausible but not instrumented/proven. Keep separate from Analytics; no provider/test repair or weakened assertion. A passing rerun does not close it. [Evidence](../redesign/phase-5/p5-07/README.md#validation-observations-retained).

- **P5-04b complete — Table/Board integration:** one Jobs filter owner and URL view switch, retained `/kanban` alias, Table page/selection lifetime and full Board population. [Acceptance/evidence](../redesign/phase-5/p5-04b/README.md). Baseline: 934 backend, 390 frontend, 77 actual browser passes + unchanged P2-D01 expected failure; security 9/6/1, configuration 3. No backend contract changes, P5-06 or B07. F04, P2-D01, incomplete axe/manual screen-reader/native touch and Board scaling remain open.

- **P5-04b query readiness complete — GO for integration's read prerequisite:** shared server query and URL interpretation, full Board versus paged Table ID parity, refresh/focus and failure evidence. [Record](../redesign/phase-5/p5-04b-readiness/README.md). Baseline: 934 backend, 384 frontend, 76 actual browser passes + unchanged P2-D01 expected failure; security 9/6/1, configuration 3. Earlier unchanged command-focus/CV smoke failures are recorded as R01/R02, not silently closed by passing reruns. No integration, P5-06 or B07 implemented; F04/manual screen-reader/native touch remain open.

- **P5-03 — Jobs Table and mobile cards complete:** restrained table/card presentation, existing Comfortable/Compact controls, localized display, partial-bulk retry, and Browser Back row focus have [real-browser and unit evidence](../redesign/phase-5/p5-03/README.md). Baseline: 918 backend, 377 frontend, 74 actual browser passes plus unchanged P2-D01 expected failure. P5-00-D02 and P4-05-O01 close for Jobs/Trash; P5-02 manual screen-reader acceptance and F04 remain open. Stop before P5-04a.
- **P5-01 — AppShell/grouped navigation complete:** existing destinations are grouped under Dashboard, Job search, Career, Admin and Account; expanded/rail/mobile access, parent/child current semantics, skip/main and route-heading focus have automated and visual evidence. Final baseline: 918 backend, 365 frontend, 70 browser passes plus unchanged P2-D01 expected failure. [Record](../redesign/phase-5/p5-01/README.md). P5-02 remains separate; no route/provider/business change or B07 work.
- **P5-02 — global shell utilities implemented, accessibility acceptance conditional:** command error/retry and stale-result isolation, grouped existing commands, keyboard selection, and notification stale-load/read/dismiss presentation pass 918 backend, 373 frontend and 74 actual browser tests plus unchanged P2-D01 expected failure. [Record](../redesign/phase-5/p5-02/README.md). P5-02-D01's spoken-name and live/state-announcement check remains mandatory for P5-15; it does not block independent P5-03 Jobs work. F04 remains open.
- **P5-00 — complete, P5-01 GO:** [record](../redesign/phase-5/p5-00/README.md) covers the five bounded shell gates, shared 1024px navigation boundary and open-drawer resize lifecycle. P5-00-D01 is closed with the existing fixed clock injected into the test; backend rerun is 916/916. No grouped-navigation redesign or B07 work in that checkpoint. F04 remains open.
- **P5-00-D02 — closed for Jobs:** P5-03 stores the originating row focus target on the list history entry and restores it after Browser Back and data load; explicit workspace Back remains intact. Four locale/theme browser cases pass. Revalidate if P5-08 changes workspace navigation. [Evidence](../redesign/phase-5/p5-03/README.md).
- **Phase 5 plan:** [bounded plan](../redesign/phase-5/README.md) maps all 57 contracts/31 routes. Board integration, native package and CV revision/rendering gates apply only to dependent slices. F04 remains open.
- **P2-D01 — successor native proof:** [P5-08b readiness](../redesign/phase-5/p5-08b-readiness/README.md) repairs SQLite ordering and executes successful capture plus immutable-content/file/ZIP assertions. Its final baseline records conversion of the original expected failure into an ordinary regression. Historical reproduction remains in Phase 2. P2-O01's initial rules-500 behavior remains unconfirmed.
- **P3-O01/P3-O02 — scoped follow-up:** P5-06/P5-07 address Dashboard/Analytics population/period/sample presentation and independent error retention. Backend metric definitions and other navigation/query surfaces remain separately scoped. Evidence is in the current [redesign decision records](../redesign/phase-3/OPEN_DECISIONS.md).
- **P4-02-D02 — bounded closure in P6-02:** company save-error feedback now remains inside the active dialog, with draft retained and deliberate Save retry. Native EN/NB persistence/readback and four modal theme/locale cases pass; [current proof](../redesign/phase-6/p6-02/README.md) retains the original failure and strengthened accessible-dialog assertions. D01 command-list semantics are addressed in P5-00; D03 progress-scroll access closes for the targeted P5-08a strip; D04's literal AI context was corrected in [P5-08b readiness](../redesign/phase-5/p5-08b-readiness/README.md) and remains regression protected. [Original evidence](../redesign/phase-4/p4-02/README.md). Modal background isolation remains intact; human acceptance is still conditional.
- **P5-08a-O01/O03 — scoped successors:** the readiness checkpoint protects existing next-task aliases and unique labelled content; [P5-08b](../redesign/phase-5/p5-08b/README.md) revalidates the seven-section adapter/composition. **O02** retains two failed menu-contrast runs and the explicitly justified settled-state fixture wait; no Dashboard styling change or broader manual certification. [Record](../redesign/phase-5/p5-08a/README.md).
- **P5-00 scoped closures:** P4-03-D01 Tooltip contrast, P4-04-O01 bottom-action toast overlap, P4-06-O01 mobile labels/focus and P4-06-O02 synthetic long admin metadata are addressed with [readiness evidence](../redesign/phase-5/p5-00/README.md). This does not certify all overlays, all accessibility targets or deployed production behavior.
- **P4-04-O02 — existing SQLite notification-save contention:** overlapping native preference read/write requests reproduced HTTP 500 with SQLite error 5 in two of ten local runs. The sequential UI test now awaits and requires the save response before readback; server concurrency remains unresolved. Investigate separately from page-layout/density work. [Evidence](../redesign/phase-4/p4-04/README.md).
- **P4-05-O01 — closed for Jobs/Trash:** P5-03 localizes standard status display and date labels while retaining raw API status values, custom labels and stored dates. [Evidence](../redesign/phase-5/p5-03/README.md).
- **F04/B06 — open:** complete the authorized main release and production ingress/runtime verification; the browser gate and runner diagnostics remain unresolved. No gate should be bypassed.

## Delivery and feature gates

- Deploy the verified CV Builder/UI batch through protected `main` and confirm the live health/version transition.
- Run authenticated production CV editing/PDF, existing-data, attachment, email-verification, OAuth, and rollback smoke checks when an authorized session is available.
- Activate Stripe only after the recurring Pro price, portal, webhook, and external secrets are configured; see [known issues](known-issues.md).
- Rehearse backup/restore and the legacy `Job`/`JobApplication` cutover against a restored production backup before removing compatibility columns.

## CV Builder preservation and next slice

The current builder already includes expandable sections, preset/free-text custom sections, section AI review, Code and other capability-aware templates, accent/typography controls, shared preview/PDF rendering, and extraction confidence handling. Preserve these under PRES-C02/C07/C08/C09/C12; they are not new backlog requirements. See the [functionality inventory](../redesign/audit/FUNCTIONALITY_INVENTORY.md) and [57-group preservation matrix](../redesign/phase-2/PRESERVATION_MATRIX.md).

The [native readiness](../redesign/phase-5/p5-09-readiness/README.md) and [pagination repair](../redesign/phase-5/p5-09-pagination-readiness/README.md) now establish the bounded local preview/PDF contract requested during P4-03. P4-03 remains the keyboard/viewport proof. Later P5-11/P5-12 presentation/control work must retain this measured output baseline and explicitly carry broader photo/wrapping/deployment-font and print-quality qualifications; do not restart already-completed builder features from archived plans.

Completed phase items are intentionally omitted here; their evidence remains in the current redesign checkpoint records and recoverable historical archive.

# Phase 6 execution — 2026-10-11

- [x] P6-00 baseline/design audit, pushed `7da083c`.
- [x] P6-01 shared corrections, pushed `a94ea0a`.
- [x] P6-02 workflow/save/retry/localisation review, pushed `c135d03`.
- [x] P6-03 bounded responsive/accessibility/localisation review and mobile Career label correction; native2/2 label and6/6 panel/label cases pass. Pushed `bd47214`, live remote=HEAD. Manual reader/device requirements remain open.
- [x] P6-04 performance/reuse baseline; standalone native1/1 and actual-provider fetch regression pass. Pushed `badfb19`, live remote=HEAD. O(N) Board capacity remains qualified.
- [x] P6-05 integrated acceptance/handoff: fresh backend1,033/frontend521/browser159/sidecar49 and separate native/fidelity lanes pass;57 groups and32 routes reconcile. Phase6 CONDITIONAL GO; production NO-GO; Phase7 CONDITIONAL GO. [Final report](../redesign/phase-6/p6-05/README.md) retains mandatory manual/provider/device/production conditions. Pushed `4669fb4`, live remote=HEAD verified2026-10-11 13:40:58 UTC; main unchanged. No Phase7 implementation or production deployment.

# Phase 7 execution — 2026-10-11

Follow the approved [Phase 7 handoff](../redesign/phase-6/p6-05/PHASE7_HANDOFF.md) and [current checkpoint ledger](../redesign/phase-7/README.md). Phase 8 implementation, P5-13 qualification/activation and production deployment remain outside this task.

- [x] P7-00 fresh scope inventory and unchanged-source fixture baseline; finite static checks pass. Commit and remote receipt in the Phase 7 ledger.
- [x] P7-01 public authentication and separate account/security presentation (implemented scope CONDITIONAL GO; account pushedad7b419/direct receipt19:16:15UTC): public sub-slice CONDITIONAL GO, pushed `8ad720d`, direct remote=HEAD verified2026-10-11 18:50:24UTC, main unchanged; affected61/native22/isolated SMTP2/helper6/auth subset87 pass. [Checkpoint record](../redesign/phase-7/p7-01/README.md) retains manual/provider/production gates. Fresh account full573/89, native6/public22/auth-boundaries10 and types/lint/build pass; all eight final post-copy PNGs actually inspected and source/context evidence frozen. Account85 and public31 current axe incompletes remain qualified; final staged finite hygiene passed; normal account pushad7b419 directly verified2026-10-11 19:16:15UTC with localHEAD=origin=live equality and clean worktree at observation, main unchanged.
- [x] P7-02 [onboarding guidance and Career overview/evidence](../redesign/phase-7/p7-02/README.md): entryad7b419 pushed/verified; onboarding implemented-scope CONDITIONAL GO32/13/4+types/lint/build/13 actual PNG inspections/hygiene, pushedd21501aa/direct receipt23:55:12UTC. Separate actual SQLite evidence-list repair91 guards/HTTP1/Release passed and pushed01281f52/direct receipt00:06:47UTC; unfinished Career work preserved/main unchanged. Career affected46/3/native14/fresh preservation2/types/lint/build and22 actual PNG inspections pass; implemented P7-02 CONDITIONAL GO, final Career hygiene PASS (four commands0,9docs347links0errors) and normal push8b4d5c2 directly verified05:51:04UTC, localHEAD=origin=live/clean worktree/main unchanged. Career0/99 axe incompletes/manual gates retained; fullfrontend610/backend1,034 are derived only, latest fresh full573/89 unchanged.
- [x] P7-03 Career structured editor and import/history: Implemented P7-03 scope is **CONDITIONAL GO**. The normal import/history push `5d6e32358c79cc8cfe505013fc79995940079767` was directly verified at 2026-10-12 17:28:54.912933UTC: local HEAD=origin=live development, clean worktree, local/origin/live main unchanged `27657f31131cd95d42f0e1290853ec9c9b3959a4`. Fresh affected76/6, ordinary native35, backend98/seeder24, types/lint/build and staged hygiene pass; 33/54 retained final images were inspected. Import17 scans0/302, editor13 scans0/377 and Career22 scans0/99 remain qualified. RD21 concurrency/partial-write recovery, old orphan records and human/device/provider/output requirements remain open. All57 groups remain56 PARTIAL/C11 DEFERRED,32 routes retained. 648/93 frontend and233 browser are derived only; latest whole573/89 remains inherited. Production NO-GO, P5-13 withholding and Phase8 separation remain unchanged.
- [ ] P7-04 CV library and public entry.
- [ ] P7-05 Discovery, Companies, Offers and Reminders.
- [ ] P7-06 remaining Application forms and global correspondence.
- [ ] P7-06F optional reviewed followMode composer: retain deferral unless its required action/fallback decision is established.
- [ ] P7-07 owner-scoped metadata projection, then Documents interface.
- [ ] P7-08 existing notifications and operations.
- [ ] P7-09 remaining Settings, Connections and data lifecycle presentation.
- [ ] P7-10 Users, Audit and System administration presentation.
- [ ] P7-11 residual Analytics/error/empty/dialog integration.
- [ ] P7-12 integrated migration acceptance and Phase 8 handoff.